video-breakdown
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
ffmpegandffprobebinaries viasubprocess.runinscripts/process_video.pyto perform video metadata extraction and frame splitting. The binary paths are configurable via environment variables (FFMPEG_BIN,FFPROBE_BIN), following standard development practices for local media processing. - [EXTERNAL_DOWNLOADS]: The
scripts/process_video.pyscript downloads video content from external URLs provided as input using thehttpxlibrary. This is a primary function of the skill to allow processing of remote media files. - [DATA_EXFILTRATION]: The
scripts/video_upload.pyscript includes functionality to upload local files to ByteDance's Tornado Object Storage (TOS). While intended for video processing workflows, this capability allows for the transfer of local files to remote vendor infrastructure, which could be misused if targeted at sensitive system files. - [PROMPT_INJECTION]: The skill processes untrusted video data from remote URLs, which constitutes a surface for indirect prompt injection if the resulting frames or metadata are subsequently interpreted as instructions by an AI agent.
- Ingestion points:
video_urlparameter inscripts/process_video.py. - Boundary markers: Absent; the downloaded content is passed directly to media processing tools.
- Capability inventory: Local file read/write, network transmission via
httpxandtosSDK, and shell command execution viasubprocess.run(FFmpeg). - Sanitization: None; the skill assumes inputs are valid media files for FFmpeg processing.
Audit Metadata